Re: free(3) const void *

[Alejandro Colomar <alx@kernel.org>]

[-- Attachment #1: Type: text/plain, Size: 1684 bytes --]

On Fri, Jan 26, 2024 at 10:40:23AM -0800, Russ Allbery wrote:
> Yes, const can't help you prevent problems where you don't use const.  :)
> 
> I'm not saying that using const catches every C programming bug.  But
> using const currently does ensure that nothing in the call stack into
> which you pass a const pointer frees that pointer, unless it uses an
> explicit cast or otherwise breaks its interface contract.
> 
> (C in general, and by design, does not protect you from code that doesn't
> follow its interface contract, instead erring on the side of providing
> escape hatches to do odd things.  Nonetheless, interface contracts such as
> const are still helpful in finding bugs within collaborating code, even if
> they're not strictly enforced in every circumstance.)
> 
> > So, after Xi's reminder, I'll reformulate my suggestion to
> 
> > 	[[gnu::access(none)]]
> > 	void free(const void *p);
> 
> > (or for compatibility reasons, do the const thing via a macro.)
> 
> Maybe I'm missing something, but I don't see how this addresses the
> concerns that were raised.

I don't regard `const` as a contract that the pointer is not made
invalid (as you said, ISO C doesn't make such a claim).

I agree that these contracts are good, even if the programmer is allowed
to break them at will (usually, via a cast).  But to me, the only
contract that a pointer is made invalid or not, is the
[[gnu::malloc(f)]] atteribute.  If you use it consistently, you should
have few surprises.  Of course, it may need adaptation.

Have a lovely night,
Alex

-- 
<https://www.alejandro-colomar.es/>
Looking for a remote C programming job at the moment.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]